{{- /*
Marketplace exposure HTTPRoutes (issue #710).

bp-catalyst-platform 1.3.0 ships the SME marketplace stack
(templates/sme-services/{marketplace,admin,console,...}.yaml) on every
Sovereign as Pods + ClusterIPs. This template attaches public hostnames
when the operator opts in via .Values.ingress.marketplace.enabled=true.

Two HTTPRoutes:

1. marketplace.<sov> → routes:
   - /api/             → marketplace-api    (BSS REST)
   - /back-office/     → admin              (Otech-staff BSS UI; "back-office"
                                              not "admin" per founder rule
                                              2026-05-03)
   - /                 → marketplace        (storefront landing + signup)

2. *.<sov> wildcard → console (per-tenant SaaS dashboard, host-routed
   inside the console pod by tenant slug).

The wildcard route is a separate HTTPRoute (not a rule on the marketplace
route) because Cilium Gateway hostname matching is per-route. Listener
attachment uses the existing cilium-gateway https listener which already
has hostname `*.${SOVEREIGN_FQDN}` from sovereign-tls/cilium-gateway.yaml,
so the wildcard cert covers all three subdomains automatically.

Service backends in the `sme` namespace (see sme-services/{marketplace,
admin,console}.yaml). marketplace-api lives in {{ .Release.Namespace }}
(catalyst-system) per its Helm chart.

Default OFF: ingress.marketplace.enabled=false in values.yaml so non-
marketplace Sovereigns don't render these routes.
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $marketplaceHost := (((.Values.ingress.hosts).marketplace).host) }}
{{- $sovFQDN := .Values.global.sovereignFQDN }}
{{- if and $marketplaceHost $sovFQDN }}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: marketplace
  namespace: {{ .Release.Namespace }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: marketplace
spec:
  parentRefs:
    - name: {{ .Values.ingress.gateway.parentRef.name | default "cilium-gateway" | quote }}
      namespace: {{ .Values.ingress.gateway.parentRef.namespace | default "kube-system" | quote }}
      {{- with .Values.ingress.gateway.parentRef.sectionName }}
      sectionName: {{ . | quote }}
      {{- end }}
  hostnames:
    - {{ $marketplaceHost | quote }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/api/"
      # /api/* is the SME BSS REST surface (auth, catalog, tenant, billing,
      # provisioning) served by the gateway Pod in the sme namespace, NOT
      # the catalyst-system marketplace-api Service. Live debugging on
      # otech103 (issue #868) showed catalyst-system/marketplace-api had
      # zero backing Pods (selector matched nothing), so PIN-signin POSTs
      # 503'd at the gateway before ever reaching the auth service. The
      # gateway in sme already proxies /auth/* to services-auth, so we
      # cross-namespace backendRef directly. ReferenceGrant
      # marketplace-routes-to-sme (in sme ns) authorises this hop.
      backendRefs:
        - name: gateway
          namespace: sme
          port: 8080
    - matches:
        - path:
            type: PathPrefix
            value: "/back-office/"
      backendRefs:
        - name: admin
          namespace: sme
          port: 8080
    - matches:
        - path:
            type: PathPrefix
            value: "/"
      backendRefs:
        - name: marketplace
          namespace: sme
          port: 8080
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tenant-wildcard
  namespace: {{ .Release.Namespace }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: tenant-wildcard
spec:
  parentRefs:
    - name: {{ .Values.ingress.gateway.parentRef.name | default "cilium-gateway" | quote }}
      namespace: {{ .Values.ingress.gateway.parentRef.namespace | default "kube-system" | quote }}
      {{- with .Values.ingress.gateway.parentRef.sectionName }}
      sectionName: {{ . | quote }}
      {{- end }}
  hostnames:
    - "*.{{ $sovFQDN }}"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/"
      backendRefs:
        - name: console
          namespace: sme
          port: 8080
{{- end }}
{{- end }}
